Roku says more than 500,000 accounts impacted in cyberattack

Streaming service provider Roku said it identified a second cyberattack that impacted about 576,000 additional accounts while investigating a breach that affected 15,000 user accounts earlier this year.

The company, which had more than 80 million active accounts, said the hackers did not gain access to any sensitive information such as full credit card numbers or other payment details.

However, the company said it identified less than 400 cases where the information was used to make unauthorised purchases of streaming service subscriptions and hardware products using the payment method stored in the accounts.

The company said it would refund or reverse charges for accounts where it has determined unauthorized purchases have been made as part of the attack.

Roku pinned the unauthorised access to “credential stuffing”, where users may have used the same credentials across different platforms.

Meanwhile, the company has enabled a two-factor authentication for all the accounts to beef up security controls.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts